Loading SasaSchool...
GDPR Compliance
School Management Information System (MIS)
Last updated: May 21, 2026
1. Introduction
SasaTech is committed to full compliance with the General Data Protection Regulation (GDPR) and the Kenya Data Protection Act, 2019. This page outlines our comprehensive approach to data protection and privacy compliance for our School Management Information System (MIS).
While GDPR primarily applies to EU residents, we implement GDPR-compliant practices globally to ensure the highest standards of data protection for all our users, regardless of their location.
2. GDPR Principles Compliance
2.1 Lawfulness, Fairness, and Transparency
- • Clear privacy notices and consent mechanisms
- • Transparent data processing practices
- • Legal basis documentation for all processing activities
- • Regular privacy impact assessments
- • Open communication about data practices
2.2 Purpose Limitation
- • Data collected only for specified educational purposes
- • Clear purpose statements for each data collection
- • No secondary processing without consent
- • Regular purpose compliance audits
- • Purpose documentation and tracking
2.3 Data Minimization
- • Collection of only necessary data
- • Regular data minimization reviews
- • Automated data cleanup processes
- • Minimal data retention periods
- • Purpose-driven data collection limits
2.4 Accuracy
- • Data validation and verification processes
- • Regular accuracy checks and updates
- • User-friendly correction mechanisms
- • Automated data quality monitoring
- • Accuracy reporting and metrics
2.5 Storage Limitation
- • Defined retention periods for all data types
- • Automated data deletion processes
- • Regular retention policy reviews
- • Legal compliance with retention requirements
- • Secure data destruction procedures
2.6 Integrity and Confidentiality
- • End-to-end encryption for data in transit and at rest
- • Access controls and authentication
- • Regular security audits and testing
- • Incident response and breach notification
- • Security awareness training for staff
2.7 Accountability
- • Comprehensive documentation of processing activities
- • Data protection impact assessments
- • Regular compliance audits and reviews
- • Staff training and awareness programs
- • Continuous improvement processes
3. Legal Basis for Processing
3.1 Consent
- • Marketing communications: Explicit consent for promotional materials
- • Third-party integrations: Consent for external service connections
- • Analytics and tracking: Consent for performance monitoring
- • Parental consent: Required for students under 16 years
- • Withdrawal mechanism: Easy consent withdrawal process
3.2 Contract Performance
- • Service delivery: Processing necessary for system operation
- • Account management: User account creation and maintenance
- • Payment processing: Fee collection and financial management
- • Technical support: System maintenance and troubleshooting
- • Integration services: Third-party service connections
3.3 Legal Obligations
- • Education regulations: Compliance with educational laws
- • Government reporting: Required data submissions
- • Tax compliance: Financial record keeping
- • Data protection laws: GDPR and local regulations
- • Court orders: Legal requests and subpoenas
3.4 Legitimate Interests
- • Security: Fraud prevention and system protection
- • Service improvement: System optimization and development
- • Analytics: Performance monitoring and insights
- • User experience: Personalization and optimization
- • Business operations: Administrative and operational needs
3.5 Vital Interests
- • Emergency situations: Health and safety emergencies
- • Medical information: Emergency medical data access
- • Safety concerns: Student and staff safety
- • Critical communications: Emergency notifications
- • Life-threatening situations: Immediate safety responses
4. Data Subject Rights
4.1 Right to Information
- • Transparency: Clear information about data processing
- • Privacy notices: Comprehensive privacy information
- • Processing details: Purpose, legal basis, and retention
- • Third-party sharing: Information about data recipients
- • Contact information: Data controller and DPO details
4.2 Right of Access
- • Data access: Complete copy of personal data
- • Processing information: Details about data processing
- • Source information: Data collection sources
- • Recipient information: Data sharing details
- • Automated decision-making: Information about profiling
4.3 Right to Rectification
- • Data correction: Update inaccurate personal data
- • Completion: Add incomplete data
- • Verification: Data accuracy verification processes
- • Notification: Inform third parties of corrections
- • Timeline: Respond within 30 days
4.4 Right to Erasure (Right to be Forgotten)
- • Data deletion: Remove personal data from systems
- • Third-party notification: Inform data recipients
- • Legal exceptions: Compliance with retention requirements
- • Verification: Confirm complete data removal
- • Documentation: Record of deletion activities
4.5 Right to Restrict Processing
- • Processing limitation: Limit data processing activities
- • Storage only: Store data without processing
- • Verification period: During accuracy verification
- • Objection period: While processing objection is considered
- • Legal requirements: When deletion is not possible
4.6 Right to Data Portability
- • Data export: Receive data in structured format
- • Machine-readable: Commonly used format (JSON, CSV)
- • Direct transfer: Transfer to another controller
- • Complete data: All personal data provided to us
- • No cost: Free data portability service
4.7 Right to Object
- • Processing objection: Object to data processing
- • Marketing objection: Opt-out of marketing communications
- • Profiling objection: Object to automated decision-making
- • Legitimate interests: Object to processing based on legitimate interests
- • Immediate effect: Stop processing upon objection
4.8 Rights Related to Automated Decision-Making
- • Human intervention: Request human review of decisions
- • Decision explanation: Understand automated decisions
- • Algorithm transparency: Information about decision logic
- • Manual override: Ability to override automated decisions
- • Appeal process: Challenge automated decision outcomes
5. Data Protection Measures
5.1 Technical Measures
- • Encryption: End-to-end encryption for data in transit and at rest
- • Access controls: Role-based access control (RBAC)
- • Authentication: Multi-factor authentication (MFA)
- • Network security: Firewalls and intrusion detection
- • Data backup: Encrypted backup and disaster recovery
5.2 Organizational Measures
- • Staff training: Regular data protection training
- • Policies and procedures: Comprehensive data protection policies
- • Background checks: Personnel screening for data access
- • Confidentiality agreements: Staff confidentiality commitments
- • Incident response: Data breach response procedures
5.3 Physical Measures
- • Data center security: 24/7 monitoring and access controls
- • Environmental controls: Climate and fire suppression
- • Power redundancy: Uninterruptible power supplies
- • Physical access: Biometric authentication and security
- • Asset management: Secure disposal of hardware
6. Data Breach Response
6.1 Breach Detection and Assessment
- • 24/7 monitoring: Continuous security monitoring
- • Automated detection: AI-powered threat detection
- • Incident classification: Risk assessment and categorization
- • Impact analysis: Assessment of potential harm
- • Documentation: Comprehensive incident records
6.2 Notification Requirements
- • 72-hour notification: Report to supervisory authority
- • Individual notification: Notify affected data subjects
- • High-risk breaches: Immediate notification for high-risk incidents
- • Detailed reporting: Comprehensive breach documentation
- • Follow-up communication: Ongoing updates and resolution
6.3 Remediation and Recovery
- • Immediate containment: Stop breach and prevent further damage
- • Forensic analysis: Detailed investigation of breach cause
- • System recovery: Restore affected systems and data
- • Security improvements: Implement additional safeguards
- • Lessons learned: Update procedures and training
7. International Data Transfers
7.1 Transfer Safeguards
- • Adequacy decisions: EU adequacy decisions for recipient countries
- • Standard contractual clauses: EU-approved SCCs
- • Binding corporate rules: BCRs for multinational transfers
- • Certification schemes: Approved certification mechanisms
- • Prior authorization: Supervisory authority approval when required
7.2 Transfer Locations
- • Primary hosting: AWS Africa (Cape Town) - Adequate protection
- • Backup locations: Multiple AWS regions with SCCs
- • CDN services: Global distribution with adequate safeguards
- • Analytics services: EU/US providers with appropriate safeguards
- • Support services: Local and international with data protection
8. Data Protection Officer
DPO Information
Name: [DPO Name]
Email: dpo@sasatech.com
Phone: +254 XXX XXX XXX
Address: Nairobi, Kenya
Responsibilities:
- • Monitor GDPR compliance
- • Provide advice on data protection
- • Conduct privacy impact assessments
- • Handle data subject requests
- • Liaise with supervisory authorities
- • Train staff on data protection
9. Compliance Monitoring
9.1 Regular Audits
- • Annual compliance audits: Comprehensive GDPR compliance reviews
- • Third-party assessments: Independent security and privacy audits
- • Penetration testing: Regular security vulnerability assessments
- • Privacy impact assessments: DPIA for new processing activities
- • Risk assessments: Ongoing risk evaluation and mitigation
9.2 Training and Awareness
- • Staff training: Regular data protection training programs
- • Role-specific training: Tailored training for different roles
- • Certification programs: Professional data protection certifications
- • Awareness campaigns: Ongoing privacy awareness initiatives
- • Testing and assessment: Regular knowledge assessments
9.3 Continuous Improvement
- • Policy updates: Regular policy review and updates
- • Process optimization: Streamlined data protection processes
- • Technology upgrades: Latest security and privacy technologies
- • Best practice adoption: Industry best practices implementation
- • Feedback integration: User and stakeholder feedback incorporation
Contact Information
Data Protection Officer
Email: dpo@sasatech.com
Phone: +254 XXX XXX XXX
Address: Nairobi, Kenya
GDPR Support
Data Rights: rights@sasatech.com
Privacy Questions: privacy@sasatech.com
Complaints: complaints@sasatech.com